GSO segmentation in zero-copy mode is broken

[Anton Nayshtut]

[SRU Justification]

[Setup]
 - 2 or more QEMU Guest VMs sharing the the same host
 - the Guests are communicating using virtio-net-pci devices
 - vhost-net is enabled

[Explanation]
If one Guest VM sends GSO packets to another while GRO is disabled for receiver, so these packets are segmented by net/core.
In this case, if zero-copy is enabled in vhost-net, the GSO packets TX completion is reported to userspace as before the TX is actually done.
The vhost-net's zero-copy mechanism is enabled by default since v3.8-rc1 (f9611c43).

[Impact]
Incorrect/junk data sent in case the transmitting Guest OS re-uses/frees the TX buffer immediately upon TX completion.

[Test Case]
Windows 2008R2 Guest VMs running MS HCK Offload LSO test.
NOTE1: GRO is always disabled in this case because it's not supported by Windows Guest virtio-net-pci drivers.
NOTE2: MS HCK re-uses the GSO (LSO) buffers, so it reproduces the issue every time.

[Note]
This bug has been fixed in v3.14-rc7 by 1fd819ec (https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=1fd819ecb90cc9b822cd84d3056ddba315d3340f).
The fix actually disables zero copy for this case since it forces unconditional fragments copying, but it resolves the issue mentioned.

[Brad Figg (brad-figg)]

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1328973

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Dave Chiluk (chiluk)]

Anton the kernel SRU process is special and is done using a mailing list

Please see
https://wiki.ubuntu.com/Kernel/Dev/StablePatchFormat
and
https://wiki.ubuntu.com/KernelTeam/KernelUpdates

[Tim Gardner (timg-tpi)]

Released with Ubuntu-3.13.0-22.44

[Luis Henriques (henrix)]

The linux-lts-saucy kernel 3.11.0-26.44~precise1 is now available in -proposed. It contains the following upstream commit, that fixes this bug:

commit 1fd819ecb90cc9b822cd84d3056ddba315d3340f
Author: Michael S. Tsirkin <email address hidden>
Date: Mon Mar 10 19:28:08 2014 +0200

    skbuff: skb_segment: orphan frags before copying

[Anton Nayshtut (anton.nayshtut)]

Verified by both me and Victor Tapia (vtapia) - with 3.11.0-26.44~precise1 kernel the MS HCK Offload LSO test passes.